ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Source: Security Affairs

7 stories in the last 7d

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 12AI safety & security 6Vulnerability 4Malware 2Data breach 2Industry 1AI policy 1Advisory 1Policy & legal 1Threat actor 1
SeverityAllcritical 8high 11medium 4low 0info 8source: Security Affairs ✕

Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day

Cisco Secure Email Gateway zero-day CVE-2026-76461 (CVSS 9.8) is actively exploited for root command execution; CISA added it to KEV.

Cisco disclosed critical zero-day CVE-2026-76461 (CVSS 9.8) in Secure Email Gateway, remotely exploitable without authentication via crafted emails containing malicious SQL statements, leading to arbitrary command execution with root privileges. The flaw affects physical and virtual appliances regardless of configuration and has no workarounds. Cisco PSIRT confirmed active exploitation, and CISA added the CVE to its KEV catalog on September 14 with a federal remediation deadline of September 17. Admins should review mail_logs for suspicious SQL statements such as 'COPY.*TO PROGRAM'.

Security Affairsupdated · 2h agofirst · 10h agoExploit / PoC in the wild 15 sourcesCVE-2026-764612· 1 read

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Two China-linked APT groups reused identical Chrome/Windows zero-day chain against NGOs, deploying GRIMWIDGE backdoor and LONGTALE credential-stealing extension.

Volexity reports that China-linked actors UTA0560 and JungleBamboo (APT31/TA412) ran byte-identical Chrome/Windows exploit chains against NGOs starting September 1, 2026, combining Chrome type confusion CVE-2026-85046, WebAssembly sandbox escape CVE-2026-87491, and Windows kernel flaw CVE-2026-85880. The Chrome bug was fixed in Chromium source but not yet shipped to Chrome users, making it an effective zero-day with an unusual patch gap. UTA0560 delivered the in-memory GRIMWEDGE JScript backdoor, while JungleBamboo deployed the SUPERSTOMP loader installing LONGTALE, a malicious Chrome extension disguised as Google Gemini that steals cookies, session tokens, and keystrokes. Volexity assesses with low confidence the exploit chain was sold or shared among different Chinese end-users.

Security Affairs · 12h agoThreat actor in the wild 20 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-85880

GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours

GitLab path traversal CVE-2026-85706 (CVSS 10.0) was actively probed and exploited within 24 hours of disclosure and added to CISA's KEV catalog.

CVE-2026-85706 is a CVSS 10.0 path traversal in GitLab's repository commits API allowing unauthenticated arbitrary file read via a single crafted HTTP request, exposing SSH keys, database credentials, deploy tokens, and CI/CD variables. watchTowr observed in-the-wild probes by September 11, one day after the September 10 disclosure, and CISA added the flaw to its Known Exploited Vulnerabilities catalog. Affected versions include CE and EE 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2; the same update also patches insecure deserialization flaw CVE-2026-87719. Defenders should patch or remove public access, hunt logs for POSTs to /api/v4/projects/{id}/repository/commits/ with file.path parameters, and rotate exposed credentials.

Security Affairsupdated · 22h agofirst · 2d agoExploit / PoC in the wild 17 sourcesCVE-2026-85706CVE-2026-87719CVE-2023-28255· 1 read

U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog

CISA added four actively exploited GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to the KEV catalog with imminent deadlines.

CISA added CVE-2026-42016 and CVE-2026-42018 (JFrog Artifactory), CVE-2026-84869 (ConnectWise ScreenConnect), and CVE-2026-85706 (GitLab, CVSS 10.0) to its KEV catalog. Artifactory flaws are being chained with CVE-2026-82329 in attacks observed August 15 to September 8, taking over self-hosted servers, creating persistent administrator accounts, and installing backdoors. ScreenConnect CVE-2026-84869 allows unauthorized file transfer and execution during remote sessions, linked by Huntress to malicious VBScript deliveries, and is fixed in version 26.6.5. GitLab's repository commits API path traversal exposes SSH keys, database credentials, deploy tokens, and CI/CD variables, with watchTowr already observing in-the-wild probes. Federal agencies must patch GitLab and ScreenConnect flaws by September 14, 2026, and Artifactory flaws by September 25, 2026.

Security Affairs · 1d agoExploit / PoC in the wild 2 sourcesCVE-2026-42016CVE-2026-42018CVE-2026-84869+3 CVEs5

Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware

Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.

Cisco Talos identified three post-compromise clusters exploiting recently patched Cisco Secure Firewall Management Center flaws. UAT-12197 deploys JSP web shells and harvests credentials; UAT-11823 (with Sandworm-overlapping tooling) installs Cyclops Blink for persistence; UAT-11988 (Qilin) uses static credentials, extensive reconnaissance, SOCKS5 proxies, reverse-SSH tunnels, AV killers, and ransomware deployment. CISA added CVE-2026-20079 to the KEV catalog with a September 12, 2026 patch deadline for federal agencies; Cisco urges immediate hotfix application.

Security Affairsupdated · 1d agofirst · 4d agoExploit / PoC in the wild 13 sourcesCVE-2026-20079CVE-2026-203165· 2 reads

UK Council Attack Linked to Mass Exploitation of SonicWall Flaw

Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.

Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.

Security Affairs · 4d agoExploit / PoC in the wildCVE-2026-154091

U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog

CISA added actively exploited Cisco FMC, Chrome V8, Fortinet and Citrix NetScaler flaws to its KEV catalog, ordering federal patching by September 12.

CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-20079 (CVSS 10.0) is an unauthenticated authentication bypass in Cisco Secure Firewall Management Center's web interface enabling script execution and potential root access. CVE-2026-87491 (CVSS 8.8) is an out-of-bounds write in Chrome's V8 engine — the seventh actively exploited Chrome zero-day of 2026 — fixed in Chrome 153.0.8010.36. CVE-2025-25249 (CVSS 8.1) is a heap-based buffer overflow in FortiOS/FortiSwitchManager's cw_acd daemon being exploited with the PivotC2 RAT, and CVE-2026-19490 (CVSS 9.3) is a NetScaler SAML HTTP-Redirect authentication bypass; federal agencies must patch by September 12, 2026.

Security Affairs · 5d agoExploit / PoC in the wild 5 sourcesCVE-2025-25249CVE-2026-19490CVE-2026-87491+1 CVEs1